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DETAILED ACTION 

Information Disclosure Statement 

1 . The information disclosure statement (IDS) submitted on September 8, 2000 is in 
compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure 
statement is being considered by the examiner. 

Claim Rejections - 35 USC § 112 

2. The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

3. Claims 1-14 and 21-23 are rejected under 35 U.S.C. 1 12, second paragraph, as 
being indefinite for failing to particularly point out and distinctly claim the subject matter 
which applicant regards as the invention. 

4. Claim 1 recites the limitation "said processor utilization value " in line 6 whereby in 
line 3, it is recited of "processor utilization level". Claim 6 recites the limitation "said 
maximum processor utilization value " on lines 3-4. Claim 10 recites the limitation "the 
amount " on line 1 . Claim 21 recites the limitation "said processor utilization value" in 
line 6 whereby in line 3, it is recited of "processor utilization level". Claim 21 additionally 
recites of the limitation "the processor " in line 5. 

There is insufficient antecedent basis for these limitations in the claims. 
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Claim Rejections - 35 USC § 101 



5. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

Claims 21-23 are rejected under 35 U.S.C. 101 because the claimed invention is 
directed to non-statutory subject matter. It is recited of a "computer program product" in 
line 1 and later recites on line 8 of "a computer readable medium that stores said 
computer codes." The "computer readable medium is further defined in claim 22 as "a 
data signal embodied in a carrier wave" as recited on lines 3-4. This makes the claim 
non-statutory because it is only recited of software alone and of itself in the claim. 



6. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 

7. Claims 1,4,8.14,21, and 22 are rejected under 35 U.S.C. 102(e) as being 
anticipated by Gleichauf et al, U.S. Patent 6,301,668. 

As per claim 1 , it is disclosed by Gleichauf et al of a method for limiting processor 



Claim Rejections - 35 USC § 102 



utilization in regards to an analysis task (scanning for viruses)(col. 3, lines 62-65 and 
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col. 7, lines 3-5). The analysis task are prioritized and are to be performed in order to 
detect attacks wherein running a signature engine (virus scanner) scans network traffic 
(data) for attacks (viruses)(col. 3, lines 51-55 and col. 6, lines 39-45,51-54). A 
processor utilization level is defined by a threshold and if the processor utilization level 
exceeds a defined threshold, a priority engine disables (suspends) running of the 
analysis task, that includes a signature engine (virus scanner), since the usage is 
limited to the threshold based on the processor utilization value (col. 7, lines 1-10). It is 
noted that the teachings of Gleichauf et a! temporarily disable (suspend) the analysis 
tasks wherein if the processor utilization level drops below a second defined threshold, 
the disabled analysis task is re-enabled (col. 7, lines 10-13). 

As per claim 4, Gleichauf et al discloses of a processor utilization level is defined 
by a threshold (maximum value) and if the processor utilization value exceed a defined 
threshold, a priority engine disables (suspends) running of the analysis task, that 
includes a signature engine (virus scanner), since the usage is limited to the threshold 
based on the processor utilization value (col. 7, lines 1-10). It is noted that the 
teachings of Gleichauf et al temporarily disable (suspend) the analysis tasks wherein if 
the processor utilization value drops below a second defined threshold, the disabled 
analysis task is re-enabled (col. 7, lines 10-13). 

As per claim 8, Gleichauf et al discloses of a processor utilization level is defined 
by a threshold and if that value is exceeded, the analysis task is disabled (col. 7, lines 1- 
5). It is interpreted by the examiner that any value less than the threshold is a defined 
average value because it is operating within normal bounds and limits. 
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As per claim 14, Gleichauf et al teaches of a processor utilization level is defined 
by a threshold (default value) and when that value is exceeded, the analysis task is 
disabled (col. 7, lines 1-5). 

As per claim 21 , it is disclosed by Gleichauf et al of limiting processor utilization 
in regards to an analysis task (scanning for viruses)(col. 7, lines 3-5). The teachings 
are software (computer program product comprising computer code) that is stored on 
system readable storage (computer readable medium)(col. 16, lines 61-62). The 
analysis task are prioritized and are to be performed in order to detect attacks wherein 
running a signature engine (virus scanner) scans network traffic (data) for attacks 
(viruses)(col. 3, lines 51-55 and col. 6, lines 39-45,51-54). A processor utilization level 
is defined by a threshold and if the processor utilization level exceeds a defined 
threshold, a priority engine disables (suspends) running of the analysis task, that 
includes a signature engine (virus scanner), since the usage is limited to the threshold 
based on the processor utilization value (col. 7, lines 1-10). It is noted that the 
teachings of Gleichauf et al temporarily disable (suspend) the analysis tasks wherein if 
the processor utilization level drops below a second defined threshold, the disabled 
analysis task is re-enabled (col. 7, lines 10-13). 

As per claim 22, Gleichauf et al recites of the use of system readable storage 
(system memory that is a computer readable medium)(col. 16, lines 61-62). 
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Claim Rejections - 35 USC § 103 



8. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

9. Claims 2,3,15,17,18, and 20 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Gleichauf et al, U.S. Patent 6,301,668 in view of Jones et al, U.S. 
Patent 5,812,844. 

As per claim 2, the teachings of Gleichauf et al are silent in disclosing the use of 
a scanner thread. Jones et al discloses that it is known in the prior art that the use of a 
(scanner) threads belong to processes which in turn constitute a program (col. 1, lines 
50-55). It would have been obvious to a person of ordinary skill in the art at the time of 
the invention to have been motivated to apply the use of threads since they are known 
as the smallest unit of execution. Jones et al recites motivation for the use of (scanner) 
threads by disclosing that threads are the finest schedulable unit of execution and since 
they contain state information about execution of the (scanner) thread, they can 
continue executing if they are suspended in such a manner that allows the (scanner) 
thread to execute from the same point it was suspended at based on the state 
information stored in the stack and register contents (col. 1, lines 35-49). It is obvious 
that the teachings of Gleichauf et al would have benefited from the use of (scanner) 
threads since Gleichauf et al discloses that an analysis task can be re-enabled from a 



Application/Control Number: 09/626,701 Page 7 

Art Unit: 2131 

disabled state (col. 7, lines 11-13) whereby Jones et al allows the (scanner) thread to 
continue from the same point it was suspended (col. 1, lines 35-49). 

As per claim 3, Gleichauf et al discloses of a processor utilization level that is 
defined by a threshold and if the processor utilization level exceed a defined threshold, 
a priority engine (controller) disables (suspends) running (execution) of the analysis 
task, that includes a signature engine (virus scanner), since the usage is limited to the 
threshold based on the processor utilization value (col. 7, lines 1-10). The teachings of 
Jones et al disclose of the use of (control) threads that instruct an operating system to 
suspend execution (col. 2, lines 25-33). Please refer to the motivation as recited above 
why it is obvious to apply the teachings of Jones et al and the use of (control) threads 
as applied to the teachings of Gleichauf et al. 

As per claim 15, it is disclosed by Gleichauf et al of a system for limiting 
processor utilization in regards to an analysis task (scanning for viruses)(col. 3, lines 59- 
61 and col. 7, lines 3-5). The teachings also recite of the use of a processor that is 
operable to execute the teachings (col. 7, lines 1-3). The analysis task are prioritized 
and are to be performed in order to detect attacks wherein running a signature engine 
(virus scanner) scans network traffic (data) for attacks (viruses)(col. 3, lines 51-55 and 
col. 6, lines 39-45,51-54). A processor utilization level is defined by a threshold and if 
the processor utilization level exceeds a defined threshold, a priority engine (controller) 
disables (suspends) running (execution) of the analysis task, that includes a signature 
engine (virus scanner), since the usage is limited to the threshold based on the 
processor utilization value (col. 7, lines 1-10). It is noted that the teachings of Gleichauf 
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et al temporarily disable (suspend) the analysis tasks wherein if the processor utilization 
level drops below a second defined threshold, the disabled analysis task is re-enabled 
(col. 7, lines 10-13). The teachings of Gleichauf et al are silent in disclosing the use of a 
scanner thread. Jones et al discloses that it is known in the prior art that the use of 
(scanner) threads belong to processes which in turn constitute a program (col. 1, lines 
50-55). It would have been obvious to a person of ordinary skill in the art at the time of 
the invention to have been motivated to apply the use of (scanner) threads since they 
are known as the smallest unit of execution. Jones et al recites motivation for the use of 
threads by disclosing that (scanner) threads are the finest schedulable unit of execution 
and since they contain state information about execution of the thread, they can 
continue executing if they are suspended in such a manner that allows the thread to 
execute from the same point it was suspended at based on the state information stored 
in the stack and register contents (col. 1 , lines 35-49). It is obvious that the teachings of 
Gleichauf et al would have benefited from the use of (scanner) threads since Gleichauf 
et al discloses that an analysis task can be re-enabled from a disabled state (col. 7, 
lines 11-13) whereby Jones et al allows the (scanner) thread to continue from the same 
point it was suspended (col. 1 , lines 35-49). 

As per claim 17, Gleichauf et al discloses of a processor utilization level is 
defined by a threshold (maximum value) and if the processor utilization value exceed a 
defined threshold, a priority engine disables (suspends) running of the analysis task, 
that includes a signature engine (virus scanner), since the usage is limited to the 
threshold based on the processor utilization value (col. 7. lines 1-10). It is noted that the 



Application/Control Number: 09/626,701 Page 9 

Art Unit: 2131 

teachings of Gleichauf et al temporarily disable (suspend) the analysis tasks wherein if 
the processor utilization value drops below a second defined threshold, the disabled 
analysis task is re-enabled (col. 7, lines 10-13). 

As per claim 18, Gleichauf et al discloses of a processor utilization level is 
defined by a threshold and if that value is exceeded, the analysis task is disabled (col. 
7, lines 1-5). It is interpreted by the examiner that any value less than the threshold is a 
defined average value because it is operating within normal bounds and limits. 

As per claim 20, Gleichauf et al discloses of a processor utilization level that is 
defined by a threshold and if the processor utilization level exceed a defined threshold, 
a priority engine (controller) disables (suspends) running (execution) of the analysis 
task, that includes a signature engine (virus scanner), since the usage is limited to the 
threshold based on the processor utilization value (col. 7, lines 1-10). The teachings of 
Jones et al disclose of the use of (control) threads that instruct an operating system to 
suspend execution (col. 2, lines 25-33). Please refer to the motivation as recited above 
why it is obvious to apply the teachings of Jones et al and the use of threads as applied 
to the teachings of Gleichauf et al. 

10. Claims 5-7 and 9-1 1 are rejected under 35 U.S.C. 103(a) as being unpatentable 
Gleichauf et al, U.S. Patent 6,301,668 in view of Jones et al, U.S. Patent 5,812,844in 
further view of Voight et al, U.S. Patent 5,623,598. 

As per claims 5 and 7, it is disclosed by Gleichauf et al of a processor utilization 
level that is defined by a threshold and if the processor utilization level exceed a defined 
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threshold, a priority engine (controller) disables (suspends) running (execution) of the 
analysis task, that includes a signature engine (virus scanner), since the usage is 
limited to the threshold based on the processor utilization value (col. 7, lines 1-10). The 
teachings of Gleichauf et al are silent in disclosing the use of a control thread. Jones et 
al discloses that it is known in the prior art that the use of a (control) threads belong to 
processes which in turn constitute a program (col. 1, lines 50-55). It would have been 
obvious to a person of ordinary skill in the art at the time of the invention to have been 
motivated to apply the use of threads since they are known as the smallest unit of 
execution. Jones et al recites motivation for the use of (control) threads by disclosing 
that threads are the finest schedulable unit of execution and since they contain state 
information about execution of the thread, they can continue executing if they are 
suspended in such a manner that allows the thread to execute from the same point it 
was suspended at based on the state information stored in the stack and register 
contents (col. 1 , lines 35-49). It is obvious that the teachings of Gleichauf et al would 
have benefited from the use of (control) threads since Gleichauf et al discloses that an 
analysis task can be re-enabled from a disabled state (col. 7, lines 11-13) whereby 
Jones et al allows the (control) thread to continue from the same point it was suspended 
(col. 1 , lines 35-49). 

Also disclosed by Gleichauf et al is the use of monitoring memory utilization to 
determine if an analysis task has reached a threshold, then disabling that analysis task 
(col. 7, lines 1-3,12-14). The teachings of Jones et al disclose of the use of (control) 
threads that instruct an operating system to suspend execution (col. 2, lines 25-33). 
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Please refer to the motivation as recited above why it is obvious to apply the teachings 
of Jones et al and the use of threads as applied to the teachings of Gleichauf et al. The 
combined teachings are silent in disclosing of the use of a sampling period. It is 
disclosed by Voight et al of comparing sampled (over a period) performance metrics to 
thresholds to determine noncompliance (col. 7, lines 23-26). It would have been 
obvious to a person of ordinary skill in the art at the time of the invention to have been 
motivated to apply the use of sampling periods as a means to evaluation system 
performance. The teachings of Voight et al recite motivation for use of sampling periods 
by disclosing it desirable to evaluate system performance during operations in order to 
anticipate situations which affect performance and to instruct a user what could be done 
to improve performance (col. 1 , lines 42-47). It is obvious that combination of the 
teachings of Gleichauf et al and Jones et al would have been improved since the intent 
of Gleichauf et al is to disable tasks that exceed thresholds, whereby the teachings of 
Jones et al are relied for the use of control threads, the teachings of Voight et al offer 
sampling periods over time to compare with thresholds to determine when the system is 
not properly operating. 

As per claim 6, it is disclosed by Gleichauf et al of a processor utilization level 
that is defined by a threshold and if the processor utilization level exceed a defined 
threshold, a priority engine (controller) disables (suspends) running (execution) of the 
analysis task, that includes a signature engine (virus scanner), since the usage is 
limited to the threshold based on the processor utilization value (col. 7, lines 1-10). Also 
disclosed is that threshold values are used as percentages (col. 8, lines 59-60). The 
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teachings of Jones et al disclose of the use of (control) threads that instruct an 
operating system to suspend execution (col. 2, lines 25-33). Please refer to the 
motivation as recited above why it is obvious to apply the teachings of Jones et al and 
the use of threads as applied to the teachings of Gleichauf et al. The teachings of 
Voight et al disclose of comparing sampled (over a period) performance metrics to 
thresholds to determine noncompliance (col. 7, lines 23-26). Please refer to the 
motivation as recited above why it is obvious to apply the teachings of Voight et al and 
the use of sampled periods as applied to the combined teachings of Gleichauf et al and 
Jones et al. The examiner is interpreting the scanner thread to be disabled if a 
threshold has exceeded (time period equal to the sampling period multiplied by one 
minus the processor utilization value) in light of the combination of Gleichauf et al, 
Jones et al, and Voight et al. 

As per claim 7, it is disclosed by Gleichauf et al of a processor utilization level 
that is defined by a threshold and if the processor utilization level exceed a defined 
threshold, a priority engine (controller) disables (suspends) running (execution) of the 
analysis task, that includes a signature engine (virus scanner), since the usage is 
limited to the threshold based on the processor utilization value (col. 7, lines 1-10). The 
teachings of Jones et al disclose of the use of (control) threads that instruct an 
operating system to suspend execution (col. 2, lines 25-33). Please refer to the 
motivation as recited above why it is obvious to apply the teachings of Jones et al and 
the use of threads as applied to the teachings of Gleichauf et al. The teachings of 
Voight et al disclose of comparing sampled (over a period) performance metrics to 
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thresholds to determine noncompliance (col. 7, lines 23-26). Please refer to the 
motivation as recited above why it is obvious to apply the teachings of Voight et al and 
the use of sampled periods as applied to the combined teachings of Gleichauf et al and 
Jones et al. The examiner is interpreting the scanner thread to be executed if a 
threshold is not exceeded (time period equal to the sampling period minus the suspend 
time period) in light of the combination of Gleichauf et al, Jones et al, and Voight et al. 

As per claim 10, it is disclosed by Gleichauf et al of a processor utilization level 
that is defined by a threshold and if the processor utilization level exceed a defined 
threshold, a priority engine (controller) disables (suspends) running (execution) of the 
analysis task, that includes a signature engine (virus scanner), since the usage is 
limited to the threshold based on the processor utilization value (col. 7, lines 1-10). Also 
disclosed is that threshold values are used as calculated percentages (suspend/run 
ratios)(col. 8, lines 59-60). The teachings of Jones et al disclose of the use of (control) 
threads that instruct an operating system to suspend execution (col. 2, lines 25-33). 
Please refer to the motivation as recited above why it is obvious to apply the teachings 
of Jones et al and the use of threads as applied to the teachings of Gleichauf et al. The 
teachings of Voight et al disclose of comparing sampled (over a period) performance 
metrics (run periods) to thresholds to determine noncompliance (col. 7, lines 23-26). 
Please refer to the motivation as recited above why it is obvious to apply the teachings 
of Voight et al and the use of sampled periods as applied to the combined teachings of 
Gleichauf et al and Jones et al. 
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As per claim 1 1 Jt is disclosed by Gleichauf et al of a processor utilization level 
that is defined by a threshold and if the processor utilization level exceed a defined 
threshold, a priority engine (controller) disables (suspends) running (execution) of the 
analysis task, that includes a signature engine (virus scanner), since the usage is 
limited to the threshold based on the processor utilization value (col. 7, lines 1-10). Also 
disclosed is that threshold values are used as percentages (suspend/run ratio)(coL 8, 
lines 59-60). The teachings of Jones et al disclose of the use of (control) threads that 
instruct an operating system to suspend execution (col. 2, lines 25-33). Please refer to 
the motivation as recited above why it is obvious to apply the teachings of Jones et al 
and the use of threads as applied to the teachings of Gleichauf et al. The teachings of 
Voight et al disclose of comparing sampled (over a period) performance metrics to 
thresholds to determine noncompliance (col. 7, lines 23-26). Voight et al additionally 
discloses of adjusting the host settings (suspend time)(col. 7, lines 59-60). Please refer 
to the motivation as recited above why it is obvious to apply the teachings of Voight et al 
and the use of sampled periods as applied to the combined teachings of Gleichauf et al 
and Jones et al. 

11 Claims 12,13,16,19, and 23 rejected under 35 U.S.C. 103(a) as being 
unpatentable over Gleichauf et al, U.S. Patent 6,301 ,668 in view of Jones et al, U.S. 
Patent 5,812,844 in further view of "Dr. Solomon's Anti-Virus Toolkit for Workstation", 
herein referred to as Solomon. 

As per claims 12 and 19, the combined teachings of Gleichauf et al and Jones et 
al are relied upon for the feature of a processor utilization level that is defined by a 
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threshold and if the processor utilization level exceed a defined threshold, a priority 
engine (controller) disables (suspends) running (execution) of the analysis task, that 
includes a signature engine (virus scanner), since the usage is limited to the threshold 
based on the processor utilization value (col. 7, lines 1-10). The teachings of Jones et 
al disclose of the use of (control) threads that instruct an operating system to suspend 
execution (col. 2, lines 25-33). Please refer to the motivation as recited above why it is 
obvious to apply the teachings of Jones et al and the use of threads as applied to the 
teachings of Gleichauf et al. The combined teachings are silent in disclosing of using 
an on-demand scanner to detect attacks (viruses). It is disclosed by Solomon of the 
use of on-demand scanners used to detect viruses (pg 67). It would have been obvious 
to a person of ordinary skill in the art at the time of the invention to have been motivated 
to apply an on-demand scanner to detect viruses. Solomon recites motivation for the 
use of on-demand scanners by reciting default setting are selected to checks for virus 
attacks when files are susceptible and it allows for a user to change the options to fine 
tune the scan for the user's requirements (pg 67). It is obvious that the combined 
teachings of Gleichauf et al and Jones et al would have benefited from the disclosure of 
Solomon as a feature of allowing the user to customize and dictate through use of an 
on-demand scanner to detect for virus attacks (pg 67). 

As per claims 13,16, and 23, the combined teachings of Gleichauf et al and 
Jones et al are relied upon for the feature of a processor utilization level that is defined 
by a threshold and if the processor utilization level exceed a defined threshold, a priority 
engine (controller) disables (suspends) running (execution) of the analysis task, that 
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includes a signature engine (virus scanner), since tlie usage is limited to the threshold 
based on the processor utilization value (col. 7, lines 1-10). The teachings of Jones et 
al disclose of the use of (control) threads that instruct an operating system to suspend 
execution (col. 2, lines 25-33). Please refer to the motivation as recited above why it is 
obvious to apply the teachings of Jones et al and the use of threads as applied to the 
teachings of Gleichauf et al. The combined teachings are silent in disclosing of 
displaying a dialog box or graphical user interface/display to allow a user to customize 
settings. Solomon discloses of the use of a dialog box or graphical user 
interface/display, as shown in pages 75 and 76, to set options (pg 76). It would have 
been obvious to a person of ordinary skill in the art at the time of the invention to have 
been motivated to use dialog box or graphical user interface/display that enables a user 
to make customizations by adjusting settings. Fryer et al recites motivation for the use 
of dialog box or graphical user interface/display by disclosing that the user is allowed to 
adjust settings through the advanced options dialog to fine tune the scan to a user's 
requirements (pg 67,76). It is obvious that the combined teachings of Gleichauf et al 
and Jones et al would have found the teachings of Solomon to be beneficial in the 
aspect that the user is allowed to make customization settings to fine tune a scan 
through use of dialog box or graphical user interface/display (pg 67,75,76). 
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Conclusion 



12. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

Kamada et al, U.S. Patent, discloses of executing processes based on 

changeable priorities. 

Brenner et al, U.S. Patent 6,584,488, discloses of controlling allocation of 
resources based on a priority calculation. 

Gleichauf et al, U.S. Patent 6,499,107, discloses of disabling resources based on 
exceeding thresholds in regards to processor utilization level. 
Kouznetsov, U.S. Patent 6,029,256, discloses of setting properties of a virus 
scan engine. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Christopher A. Revak whose telephone number is 703- 
305-1843. The examiner can normally be reached on Monday-Friday, 6:30am-4:00pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz Sheikh can be reached on 703-305-9648. The fax phone number for 
the organization where this application or proceeding is assigned is 703-872-9306. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 
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